Chip and pin failureShell petrol stations hit by million pound fraud

08 May 2006

Hundreds of Shell petrol stations across the country had to suspend chip and Pin payments over the weekend after fraudsters were able to steal more than GBP 1 million from unwitting customers.

The Chip and Pin method in action

Eight people have been arrested in connection with the racket, which is being investigated by the Metropolitan Police's Cheque and Plastic Crime Unit.

Customers had their credit and debit card details copied and then money withdrawn from their accounts.

The criminals had implanted devices into chip and Pin machines which can copy a bank card's magnetic strip and record a person's pin number. The device cannot copy the chip, which means any fake card can only be used in machines where chip and Pin is not implemented - often abroad.

Shell suspended chip and Pin in 600 of its company owned petrol stations across the UK. Eight people have been arrested in connection with the scam, including one person from Guildford and another from Portsmouth, according to the Association of Payment Clearing Services (Apacs).

Skimming device

The association's spokeswoman Sandra Quinn said: 'They have used an old style skimming device. They are skimming the card, copying the magnetic details - there is no new fraud here.

'They have managed to tamper with the Pin pads. These pads are supposed to be tamper resistant, they are supposed to shut down, and so that has obviously failed.'

There are nearly 1,000 Shell outlets in the UK, 400 of which are run by external franchisers who will continue to use the chip and Pin service.

A Shell spokeswoman said: 'In the interests of our customers, we have temporarily suspended chip and Pin availability in our UK company owned service stations.

'This is a precautionary measure to protect the security of our customers' transactions. Customers are unaffected by this action - you can still pay for your fuel, goods or services with your card by swipe and signature.

Card fraud

'We will reintroduce chip and pin as soon as it is possible, following consultation with the terminal manufacturer, card companies and the relevant authorities, to ensure that customers can be confident that their transactions are fully secure.'

Chip and Pin was introduced to cut down on card fraud and since February the vast majority of credit and debit cardholders have had to know their Pin number to be sure of paying with their chip and Pin cards.

Our advice is that consumers should never write down their Pin number, and never tell anyone else what it is. If you do either of these, you could be liable if someone gets hold of your card and Pin and uses them fraudulently.

Under the Banking Code - the voluntary code that most banks and card providers have signed up to - the most you'll ever have to pay if someone steals and uses your card is GBP 50 and in most cases you don't have to pay anything.

But this applies only if you've taken reasonable care to protect your card and Pin number; writing down your Pin number means you could lose this valuable protection and end up giving your money away to a fraudster.

It's best practice not to use an obvious number such as your birthday as your Pin, and also not to use the same Pin for all your cards if you can possibly avoid it. This is because it makes it easier for a fraudster to guess your Pin, and if you fall victim, banks may interpret the wording of the code in different ways on these issues.